Data Processing and Third Parties

These terms form part of our Terms of Service. They apply to the personal data of your own customers that you put into QuoteMaster, such as names, addresses, phone numbers and email addresses. In UK GDPR terms, you are the controller and we are the processor. For the small amount of data we hold about you (your email address and subscription), we are the controller, which the Privacy Policy covers. If these terms and the Terms of Service disagree about your customers' personal data, these terms win.

1. What we process, and for how long. The subject matter is running QuoteMaster for you: encrypted backup, team syncing, enquiry email relay, sharing quotes by link, text messages, AI requests and card payments. The data is the customer details you enter, such as names, contact details, addresses, and job and invoice details. The people concerned are your customers and enquirers. We process it for as long as your account is open, then until it is deleted as set out in section 8.

2. Your instructions. We process your customers' data only on your documented instructions. Using the app and its settings is your instruction. We will tell you if we think an instruction breaks data protection law. We will not process the data for our own purposes.

3. Confidentiality. Anyone at QuoteMaster who can reach personal data is bound by a duty of confidentiality. Backups, team syncs and quotes shared by link are encrypted on your device with a key we never receive, so we cannot read their contents. Enquiries that arrive from the open web are the exception: they are encrypted on our server while they wait for your phone, and our server holds the key for those.

4. Security. We keep to the measures in the Security Measures section of the Privacy Policy. They include end-to-end encryption of backups and syncs, salted password hashes, signed sessions and HTTPS for all traffic. If we learn of a personal data breach affecting your customers' data, we will tell you without undue delay, and give you what we know so that you can decide whether to tell the ICO and the people affected.

5. Sub-processors. You give us general permission to use the services in Part 2 that can receive your customers' data. We have a written contract with each one that carries data protection terms, and we stay responsible to you for what they do on our behalf. Before we add or replace one, we will update Part 2 and email you at least 30 days ahead. You may object in that time by emailing us. If we cannot resolve it, you may cancel and delete your account, and we will not add the new service for your data in the meantime.

6. Your customers' rights. The app lets you see, correct, export and delete your customers' records. If a customer asks us directly, we will pass the request to you and not answer it ourselves, unless the law requires us to.

7. Help with your obligations. We will help you meet your duties on security, breach notification, impact assessments and consulting the regulator, taking into account what we hold and can read. Because backups are encrypted, we cannot search or extract your customers' data for you.

8. Deletion or return. When your account ends, or when you ask, we delete the encrypted backups, sync records and keys we hold for it. Deleting in the app or on the delete account page takes effect straight away. A request by email is finished within 30 days. You can export your records from the app before you go. Records we must keep by law, such as payment records for tax, are kept for the period the law requires and used for nothing else.

9. Audits. We will give you the information needed to show that we meet these terms, and we will allow audits you reasonably need. Because we hold only encrypted data, we will first answer a written questionnaire. If that is not enough, you may audit on 30 days' written notice, in business hours and in a way that does not disrupt the service or expose other customers' data. Each side pays its own costs.

10. Transfers outside the UK. Our servers are in the United States. Part 2 says where each service runs. Where personal data goes to a country without a UK adequacy decision, it is covered by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise by the standard contractual clauses with the UK Addendum in the provider's data processing terms.

Google Play: Distributes the app. It does not receive your customers' data from QuoteMaster.

Services not released yet: They are not listed here. If we add a service that can receive your customers' data, we will list it, with where it runs, and email you before it is switched on, as section 5 says.